2

I have been trying to reverse engineer a game for a while now. I have a pattern already for the function I want to find:

\x89\x54\x24\x10\x4C\x89\x44\x24\x18\x4C
\x89\x4C\x24\x20\x48\x83\xEC\x28\x48\x85
\xC9\x75\x08\x8D\x41\x2B\x48\x83\xC4\x28
\xC3\x4C

Can I find the function with that pattern using IDA or x64dbg?

2
  • Using IDA, do you mean the IDA debugger? (asking since the second software is a debugger)
    – zi0Black
    Dec 20 '21 at 14:52
  • @zi0Black Yes - at least I think I'm not 100% sure about the name
    – CoolNite
    Dec 20 '21 at 17:56
2

In IDA, you can find sequences of bytes via Search->Sequence of bytes. That said, if your byte pattern is poorly-chosen (for reasons such as that it includes relocatable byte sequences, or it was created for a different version of the software), the result of the search may well be that the pattern cannot be found in the target binary.

2
  • Thanks for the answer! It didn't really work but that's more of a problem on my side that I'll figure out. Not your fault at all. Thanks again for answering
    – CoolNite
    Dec 20 '21 at 18:24
  • No problem. If it doesn't match, try "reducing" your pattern, i.e., selecting some subset of it, and seeing if you can match the smaller one. Try to choose a long sequence that doesn't include any bytes that are interpreted as offsets or displacements. Dec 20 '21 at 20:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.